• 2022-11-28
    Android C 原理

    InvisiableMaze

    题目考点：

    ​ 1. 玩玩游戏

    ​ 2. 魔改xxtea

    ​ 3. 解动态迷宫

    ​ 4. so的section节区脱壳

    ​ 5. NativeActivity（无java代码）

    题目难度：

    中等

    poster

    题目Hint：

    1. play games
    2. have you noticed function env?
    3. or Maybe you don’t know I’ll change
    4. Maybe you can try to run the Android 7.1 simulator

    解题思路：

    ​ 1. 动态调试，脱壳，dump出map（或提取数据，解xxtea获得map）

    ​ 2. 解出迷宫路线，但迷宫将在移动时变换，后面还需要dump新的map

    ​ 3. 并且解出迷宫，合并路线，生成md5的flag

    ​ 4. 需要注意，上下左右是一次走到底，不会有类似连续“上移”等场景，易使flag得出错误

    题目下载：

    以下两个地址均可：

    蓝奏云： https://wwm.lanzouv.com/iyNic0gplh8d (d0g3)

    阿里云：https://www.aliyundrive.com/s/DhZDFCNdzrN （9k3l）

    image-20221128110300566

    题目wp

    先ida找到map的偏移（0x25604）

    image-20221119160459673

    同时容易得出该迷宫大小为40x40=1600。然后动态调试，找到so库的基址，然后frida来dump出map，这里记录为文件map0

    image-20221119154342963

    十六进制查看：

    image-20221119155239404

    写大小为40x40的解迷宫python脚本

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    99
    100
    101
    102
    103
    maze0 = [
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,],
    [0,0,1,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,1,1,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,],
    [1,0,0,0,1,0,0,0,1,0,0,1,1,1,0,1,1,0,1,0,0,1,1,1,0,1,1,0,0,1,1,1,0,1,0,0,1,0,1,1,],
    [1,1,1,0,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,1,0,1,1,0,0,0,0,1,1,0,0,0,1,1,],
    [1,0,0,1,0,1,0,0,0,0,0,0,1,1,0,0,1,1,1,1,1,1,0,1,0,0,0,1,1,1,0,1,0,0,0,1,1,0,0,1,],
    [1,0,1,1,0,1,0,1,1,1,1,0,0,1,1,1,0,1,0,0,0,0,0,1,1,1,0,1,0,1,0,0,1,1,0,0,0,1,1,1,],
    [1,0,0,0,1,0,0,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,0,1,1,0,0,0,0,1,1,0,0,0,1,1,1,0,0,1,],
    [1,0,1,0,0,0,1,0,1,0,0,1,1,1,1,1,0,1,0,0,0,1,1,1,1,0,1,1,0,1,1,0,1,0,0,0,0,0,1,1,],
    [1,1,0,0,1,1,0,0,0,0,1,0,0,1,0,0,0,0,0,1,0,1,0,1,0,0,0,1,1,1,0,1,1,1,1,0,1,0,0,1,],
    [1,1,0,1,0,0,1,1,1,0,1,1,0,1,0,1,1,1,0,1,0,1,0,0,0,1,0,0,0,0,0,1,0,0,0,0,1,1,1,1,],
    [1,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,1,0,1,0,0,0,1,1,1,1,1,1,1,1,0,0,0,1,1,0,1,0,0,1,],
    [1,0,1,1,1,1,0,1,1,1,0,1,0,1,1,1,0,0,1,0,1,1,0,1,0,0,1,1,1,0,1,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,1,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,],
    [1,0,0,0,1,0,1,1,0,1,1,0,1,1,1,1,0,1,1,1,1,1,0,1,1,0,1,0,1,0,1,1,1,1,0,0,0,1,0,1,],
    [1,1,1,0,0,0,1,0,0,0,0,1,0,0,1,0,0,0,0,1,1,1,1,0,1,1,1,0,0,0,0,0,1,1,1,1,0,1,1,1,],
    [1,0,0,1,1,0,1,1,1,1,0,1,1,0,1,0,1,1,0,1,0,0,0,0,1,0,1,0,1,1,1,0,1,1,0,0,0,0,0,1,],
    [1,1,0,0,0,0,0,0,1,0,1,1,1,0,1,1,1,0,0,0,1,0,1,0,0,0,1,1,0,1,0,0,0,1,0,1,1,1,0,1,],
    [1,0,0,1,1,1,1,0,1,0,1,0,0,0,1,0,1,0,1,0,0,0,1,1,1,0,1,0,1,1,0,1,0,1,1,1,0,0,1,1,],
    [1,0,1,0,1,1,0,0,0,0,1,0,1,0,0,0,1,0,1,1,1,0,1,0,0,0,0,0,1,0,1,1,1,0,0,0,0,1,0,1,],
    [1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,1,0,0,0,1,0,1,0,0,1,1,1,0,1,0,0,0,0,0,1,1,0,1,0,1,],
    [1,1,1,0,1,0,0,0,0,1,1,0,1,0,1,1,0,1,1,1,0,1,0,1,0,0,0,1,0,0,1,0,1,1,1,0,1,0,0,1,],
    [1,0,1,1,0,0,1,1,0,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,0,0,1,1,1,0,0,0,0,0,1,0,1,1,],
    [1,0,0,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,0,1,0,1,1,1,0,1,1,1,0,1,1,1,1,0,1,0,0,0,1,1,],
    [1,1,0,0,0,1,0,1,1,0,1,0,0,1,1,0,1,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,1,1,1,1,1,],
    [1,1,0,1,0,1,0,0,0,0,0,0,1,0,0,0,1,0,1,0,1,0,0,1,1,1,1,1,0,1,0,1,1,0,1,0,0,0,0,1,],
    [1,1,0,1,0,0,0,1,1,1,1,0,1,0,1,0,1,0,0,0,0,1,0,0,0,1,1,0,0,0,0,1,0,1,1,1,1,1,0,1,],
    [1,0,0,1,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,1,1,1,1,1,1,0,1,0,1,1,0,1,0,0,0,0,0,1,0,1,],
    [1,0,1,0,0,0,0,0,1,0,1,1,1,0,1,1,0,0,0,0,1,0,0,0,0,0,1,1,1,1,1,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,1,1,1,0,1,0,0,0,1,0,0,1,1,1,0,1,0,1,1,1,0,1,0,0,0,1,1,0,1,0,0,0,0,0,1,],
    [1,0,0,1,0,0,0,0,0,1,1,0,1,1,1,0,0,0,0,0,0,0,1,0,0,0,0,1,0,1,0,0,1,1,1,1,0,1,0,1,],
    [1,1,0,0,0,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,1,0,1,0,1,1,0,1,0,1,1,0,0,0,0,0,0,1,1,1,],
    [1,0,1,1,0,0,0,1,1,1,0,1,0,0,1,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,0,1,1,1,1,0,1,0,0,1,],
    [1,0,0,0,1,1,0,1,0,0,0,1,1,0,0,0,0,0,1,1,0,1,0,0,0,1,1,1,0,1,0,1,0,0,0,0,1,0,1,1,],
    [1,0,1,0,1,0,0,0,0,1,0,0,1,0,1,1,1,1,1,0,0,0,1,0,1,0,0,0,0,0,0,1,1,0,1,1,1,0,0,1,],
    [1,1,1,0,0,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,1,0,0,0,1,0,1,1,1,1,0,1,0,0,1,0,0,1,0,1,],
    [1,0,1,0,1,1,0,0,1,0,0,1,0,1,1,0,1,1,1,1,1,1,1,1,0,1,0,1,0,0,0,0,0,1,0,1,0,0,0,1,],
    [1,0,0,0,0,0,1,0,1,1,0,0,0,0,1,0,1,0,0,0,1,0,0,0,0,1,0,1,1,1,1,1,1,0,0,1,1,0,1,1,],
    [1,0,1,1,1,0,1,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,1,],
    [1,0,0,1,0,0,0,0,1,0,0,0,0,1,0,1,1,0,0,1,1,0,0,0,1,1,0,0,0,1,1,1,1,0,0,0,1,0,0,0,],
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,]
    ]

    dirs = [
        lambda x, y: (x + 1, y),
        lambda x, y: (x - 1, y),
        lambda x, y: (x, y - 1),
        lambda x, y: (x, y + 1)
    ]
     
    def getPath(maze,x1,y1,x2,y2):
        stack = []
        path = []
        shorts = []
        stack.append((x1,y1))
        while len(stack)>0:
            curNode = stack[-1]  #当前的节点
            if curNode[0] == x2 and curNode[1] == y2:
                X1 = x1
                Y1 = y1
                for p in stack:
                    if p[0] != X1:
                        if p[0] - 1 == X1:
                            path.append("down") #down 0
                        else:
                            path.append("up") #up d
                    if p[1] != Y1:
                        if p[1] - 1 == Y1:
                            path.append("right") #right 3
                        else:
                            path.append("left") #left g
                    X1 = p[0]
                    Y1 = p[1]
                print("xyPosition:\n",stack)
                print("stepPosition:\n",path)
                Tmp = ''
                for d in path:
                    if d!=Tmp:
                        shorts.append(d)
                        Tmp = d       
                print("step:\n",shorts)
                print("control:\n",'-'.join(shorts))
                return stack,path    #Ture
     
            for di in dirs:
                nextNode = di(curNode[0],curNode[1])  #如果下一个结点可以走
                if maze[nextNode[0]][nextNode[1]] ==0:
                    stack.append(nextNode)
                    maze[nextNode[0]][nextNode[1]] = 2  #标记为已经走过
                    break
            else:
                maze[nextNode[0]][nextNode[1]] = 2
                stack.pop()
        else:
            print("noWay")
            return False
    #解出map0的路线
    getPath(maze0,1,0,38,39)
    ​```
    control:
     right-down-right-up-right-down-right-down-right-down-right-down-right-down-left-down-left-down-right-down-right-down-right-down-right-up-right-down-right-down-left-down-left-down-left-down-left-down-left-down-right-down-left-down-left-down-right-down-right-up-right-down-right-up-right-down-right-down-right-up-right-down-right-up-right-down-right

    ​```

    image-20221119161552604

    解完迷宫，在游戏里面走了一下，

    image-20221119162325954

    发现在人物走到步骤“xxx-down-left”的位置后，后面步骤全然不通。猜想迷宫地图变了。

    这时，用相同的方法dump出新的地图map1，并且修复新dump出的map1，因为在走map0时，跳转到map1，且走了错误的map1，修复就回退走的路设置1为0

    image-20221119163304300

    image-20221119163215444

    修复map1后，并再次解迷宫。

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    maze1 = [
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,],
    [0,0,0,1,1,1,0,0,1,1,1,0,1,0,1,1,1,0,0,0,0,1,0,0,1,0,0,0,0,0,1,1,1,0,0,0,0,1,0,1,],
    [1,1,0,1,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,1,1,0,1,1,0,0,0,0,1,1,0,0,0,1,],
    [1,0,0,0,0,1,1,1,1,0,1,0,1,0,1,0,1,0,0,0,1,1,0,1,0,0,0,0,1,1,1,0,1,0,0,1,1,1,0,1,],
    [1,0,1,1,0,1,0,0,0,0,1,1,0,1,1,0,0,1,1,0,1,1,1,1,1,0,1,0,1,0,0,0,1,1,1,0,0,0,1,1,],
    [1,0,1,0,1,1,1,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,0,0,0,0,1,0,0,0,1,0,1,0,0,0,1,0,1,1,],
    [1,0,0,0,1,0,0,0,1,1,1,1,0,1,0,0,0,1,0,1,0,1,1,0,1,0,0,1,1,0,1,0,0,0,1,0,0,1,0,1,],
    [1,1,1,0,0,0,1,0,1,1,0,0,0,0,0,1,0,1,0,1,1,0,0,0,1,1,1,0,1,1,1,1,1,0,1,1,0,0,0,1,],
    [1,0,1,1,1,0,0,1,0,0,1,1,1,1,0,1,0,1,1,0,0,0,1,0,1,0,1,0,0,0,0,0,1,1,0,0,1,1,1,1,],
    [1,0,0,0,0,1,0,0,0,1,0,0,0,1,1,1,1,0,0,0,1,0,1,1,1,0,1,0,1,1,1,0,1,0,1,0,0,0,0,1,],
    [1,1,1,0,1,1,1,1,0,0,1,1,0,0,0,0,0,0,1,0,1,0,1,0,0,0,1,1,0,0,0,0,1,0,0,0,1,1,0,1,],
    [1,0,0,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,1,0,0,0,0,1,0,0,0,0,1,1,1,0,1,1,1,0,0,0,1,],
    [1,1,0,1,1,1,1,0,0,0,0,0,1,0,0,0,1,0,1,1,1,1,1,0,1,1,1,1,0,1,0,1,0,0,0,0,0,1,1,1,],
    [1,1,0,0,0,0,1,0,1,1,1,0,1,0,1,0,1,0,1,0,0,1,0,0,0,1,0,0,0,0,0,1,1,1,0,1,0,0,1,1,],
    [1,1,0,1,0,1,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,1,0,1,1,1,0,1,1,1,0,1,0,1,0,1,1,1,0,1,],
    [1,1,0,1,0,0,1,1,1,0,1,1,1,0,1,0,0,1,0,1,0,0,0,0,0,1,1,1,0,0,0,0,0,1,0,0,0,0,0,1,],
    [1,0,0,0,1,0,0,0,1,1,1,0,0,0,0,1,1,1,0,1,0,1,1,1,0,1,0,1,0,1,1,1,0,1,0,1,0,1,1,1,],
    [1,0,1,1,0,0,1,0,0,0,1,0,1,1,1,0,1,0,1,1,0,1,1,0,0,0,0,1,0,1,1,1,1,1,0,1,0,0,0,1,],
    [1,0,1,0,1,1,0,0,1,0,0,0,0,1,1,0,1,0,0,0,1,0,1,0,1,1,0,1,1,0,0,0,0,1,1,1,1,1,0,1,],
    [1,0,1,0,0,0,1,1,1,0,1,1,1,1,1,0,0,0,1,0,1,0,0,0,0,1,0,0,1,1,0,1,1,0,0,0,0,0,0,1,],
    [1,0,1,0,1,0,0,0,1,1,1,1,0,0,1,0,1,1,1,0,0,0,1,1,0,1,1,1,0,0,0,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,0,1,0,0,0,0,1,1,0,0,0,0,0,1,0,1,1,1,0,1,0,0,0,0,1,0,0,0,1,0,0,0,0,1,1,],
    [1,0,0,1,0,1,1,1,1,0,1,1,1,0,1,1,1,1,1,1,0,0,0,0,1,1,0,1,0,1,1,1,0,1,1,1,0,1,0,1,],
    [1,1,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,0,1,0,1,1,0,0,0,1,1,0,0,0,1,0,0,0,0,1,0,1,],
    [1,1,1,0,0,1,0,1,1,1,0,0,0,1,0,1,0,0,1,0,1,0,0,0,0,1,0,1,1,1,0,1,1,1,0,1,0,0,0,1,],
    [1,1,1,0,1,1,0,0,0,0,0,1,1,0,0,0,0,1,0,0,0,1,0,1,0,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,],
    [1,1,0,0,0,1,0,1,1,1,1,1,1,1,1,1,0,1,1,1,0,1,0,1,1,0,1,1,0,0,0,1,0,1,1,1,0,0,0,1,],
    [1,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,1,0,0,0,0,0,0,1,0,0,0,1,0,1,1,1,0,0,0,1,0,1,1,1,],
    [1,0,0,0,0,0,0,0,0,1,1,0,0,0,0,1,0,0,1,1,1,1,0,1,1,1,0,1,1,1,1,1,1,0,1,0,0,0,1,1,],
    [1,0,1,1,0,1,1,1,0,1,1,0,1,0,1,1,0,1,1,0,1,1,1,0,1,0,0,0,1,1,0,0,0,0,1,1,1,0,1,1,],
    [1,0,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,1,1,0,0,0,1,0,0,0,1,1,1,1,1,0,1,0,1,0,0,0,0,1,],
    [1,1,0,1,0,1,0,1,1,1,0,0,0,1,1,0,0,0,1,0,1,0,1,0,1,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,],
    [1,0,0,1,0,1,0,0,0,0,1,1,1,0,1,0,1,0,0,0,1,0,0,0,0,1,1,1,0,0,1,0,1,0,0,0,0,1,0,1,],
    [1,1,1,0,0,1,0,1,0,1,1,1,1,0,0,0,1,0,1,1,1,0,1,1,1,1,0,0,0,1,1,1,1,0,1,1,0,0,0,1,],
    [1,0,0,1,1,1,0,1,0,0,0,0,1,0,1,1,0,0,0,0,1,1,1,1,0,0,0,1,0,0,1,1,0,0,0,1,1,1,0,1,],
    [1,1,0,0,0,1,0,1,0,1,0,1,1,1,1,0,0,1,1,0,1,0,0,0,0,1,0,1,1,1,0,1,0,1,1,0,0,0,1,1,],
    [1,0,0,1,0,0,0,0,1,1,0,0,0,0,1,0,1,0,0,0,0,1,0,1,0,1,0,1,1,1,0,0,0,0,1,1,0,1,1,1,],
    [1,1,1,1,0,1,1,1,0,0,0,1,0,1,0,0,0,1,1,1,1,0,0,1,1,0,0,0,1,1,0,1,1,1,0,0,0,1,1,1,],
    [1,0,0,0,0,0,0,1,0,1,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,0,1,0,0,0,0,0,0,1,0,0,0,0,],
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,]   
    ]

    dirs = [
        lambda x, y: (x + 1, y),
        lambda x, y: (x - 1, y),
        lambda x, y: (x, y - 1),
        lambda x, y: (x, y + 1)
    ]
     
    def getPath(maze,x1,y1,x2,y2):
        stack = []
        path = []
        shorts = []
        stack.append((x1,y1))
        while len(stack)>0:
            curNode = stack[-1]  #当前的节点
            if curNode[0] == x2 and curNode[1] == y2:
                X1 = x1
                Y1 = y1
                for p in stack:
                    if p[0] != X1:
                        if p[0] - 1 == X1:
                            path.append("down") #down 0
                        else:
                            path.append("up") #up d
                    if p[1] != Y1:
                        if p[1] - 1 == Y1:
                            path.append("right") #right 3
                        else:
                            path.append("left") #left g
                    X1 = p[0]
                    Y1 = p[1]
                print("xyPosition:\n",stack)
                print("stepPosition:\n",path)
                Tmp = ''
                for d in path:
                    if d!=Tmp:
                        shorts.append(d)
                        Tmp = d       
                print("step:\n",shorts)
                print("control:\n",'-'.join(shorts))
                return stack,path    #Ture
     
            for di in dirs:
                nextNode = di(curNode[0],curNode[1])  #如果下一个结点可以走
                if maze[nextNode[0]][nextNode[1]] ==0:
                    stack.append(nextNode)
                    maze[nextNode[0]][nextNode[1]] = 2  #标记为已经走过
                    break
            else:
                maze[nextNode[0]][nextNode[1]] = 2
                stack.pop()
        else:
            print("noWay")
            return False
    #解出map1的路线
    getPath(maze1,1,0,38,39)

    image-20221119163808937

    将地图一二相同的路线坐标输出，得出共同坐标。然后合并路线。

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    99
    100
    101
    102
    103
    104
    105
    106
    107
    108
    109
    110
    111
    112
    113
    114
    115
    116
    117
    118
    119
    120
    121
    122
    123
    124
    125
    126
    127
    128
    129
    130
    131
    132
    133
    134
    135
    136
    137
    138
    139
    140
    141
    142
    143
    144
    145
    146
    147
    148
    149
    150
    151
    152
    153
    154
    155
    156
    157
    158
    159
    160
    161
    162
    163
    164
    165
    166
    167
    168
    169
    170
    171
    172
    173
    174
    175
    176
    177
    178
    #使用栈来存储路径
    maze0 = [
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,],
    [0,0,1,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,1,1,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,],
    [1,0,0,0,1,0,0,0,1,0,0,1,1,1,0,1,1,0,1,0,0,1,1,1,0,1,1,0,0,1,1,1,0,1,0,0,1,0,1,1,],
    [1,1,1,0,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,1,0,1,1,0,0,0,0,1,1,0,0,0,1,1,],
    [1,0,0,1,0,1,0,0,0,0,0,0,1,1,0,0,1,1,1,1,1,1,0,1,0,0,0,1,1,1,0,1,0,0,0,1,1,0,0,1,],
    [1,0,1,1,0,1,0,1,1,1,1,0,0,1,1,1,0,1,0,0,0,0,0,1,1,1,0,1,0,1,0,0,1,1,0,0,0,1,1,1,],
    [1,0,0,0,1,0,0,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,0,1,1,0,0,0,0,1,1,0,0,0,1,1,1,0,0,1,],
    [1,0,1,0,0,0,1,0,1,0,0,1,1,1,1,1,0,1,0,0,0,1,1,1,1,0,1,1,0,1,1,0,1,0,0,0,0,0,1,1,],
    [1,1,0,0,1,1,0,0,0,0,1,0,0,1,0,0,0,0,0,1,0,1,0,1,0,0,0,1,1,1,0,1,1,1,1,0,1,0,0,1,],
    [1,1,0,1,0,0,1,1,1,0,1,1,0,1,0,1,1,1,0,1,0,1,0,0,0,1,0,0,0,0,0,1,0,0,0,0,1,1,1,1,],
    [1,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,1,0,1,0,0,0,1,1,1,1,1,1,1,1,0,0,0,1,1,0,1,0,0,1,],
    [1,0,1,1,1,1,0,1,1,1,0,1,0,1,1,1,0,0,1,0,1,1,0,1,0,0,1,1,1,0,1,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,1,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,],
    [1,0,0,0,1,0,1,1,0,1,1,0,1,1,1,1,0,1,1,1,1,1,0,1,1,0,1,0,1,0,1,1,1,1,0,0,0,1,0,1,],
    [1,1,1,0,0,0,1,0,0,0,0,1,0,0,1,0,0,0,0,1,1,1,1,0,1,1,1,0,0,0,0,0,1,1,1,1,0,1,1,1,],
    [1,0,0,1,1,0,1,1,1,1,0,1,1,0,1,0,1,1,0,1,0,0,0,0,1,0,1,0,1,1,1,0,1,1,0,0,0,0,0,1,],
    [1,1,0,0,0,0,0,0,1,0,1,1,1,0,1,1,1,0,0,0,1,0,1,0,0,0,1,1,0,1,0,0,0,1,0,1,1,1,0,1,],
    [1,0,0,1,1,1,1,0,1,0,1,0,0,0,1,0,1,0,1,0,0,0,1,1,1,0,1,0,1,1,0,1,0,1,1,1,0,0,1,1,],
    [1,0,1,0,1,1,0,0,0,0,1,0,1,0,0,0,1,0,1,1,1,0,1,0,0,0,0,0,1,0,1,1,1,0,0,0,0,1,0,1,],
    [1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,1,0,0,0,1,0,1,0,0,1,1,1,0,1,0,0,0,0,0,1,1,0,1,0,1,],
    [1,1,1,0,1,0,0,0,0,1,1,0,1,0,1,1,0,1,1,1,0,1,0,1,0,0,0,1,0,0,1,0,1,1,1,0,1,0,0,1,],
    [1,0,1,1,0,0,1,1,0,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,0,0,1,1,1,0,0,0,0,0,1,0,1,1,],
    [1,0,0,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,0,1,0,1,1,1,0,1,1,1,0,1,1,1,1,0,1,0,0,0,1,1,],
    [1,1,0,0,0,1,0,1,1,0,1,0,0,1,1,0,1,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,1,1,1,1,1,],
    [1,1,0,1,0,1,0,0,0,0,0,0,1,0,0,0,1,0,1,0,1,0,0,1,1,1,1,1,0,1,0,1,1,0,1,0,0,0,0,1,],
    [1,1,0,1,0,0,0,1,1,1,1,0,1,0,1,0,1,0,0,0,0,1,0,0,0,1,1,0,0,0,0,1,0,1,1,1,1,1,0,1,],
    [1,0,0,1,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,1,1,1,1,1,1,0,1,0,1,1,0,1,0,0,0,0,0,1,0,1,],
    [1,0,1,0,0,0,0,0,1,0,1,1,1,0,1,1,0,0,0,0,1,0,0,0,0,0,1,1,1,1,1,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,1,1,1,0,1,0,0,0,1,0,0,1,1,1,0,1,0,1,1,1,0,1,0,0,0,1,1,0,1,0,0,0,0,0,1,],
    [1,0,0,1,0,0,0,0,0,1,1,0,1,1,1,0,0,0,0,0,0,0,1,0,0,0,0,1,0,1,0,0,1,1,1,1,0,1,0,1,],
    [1,1,0,0,0,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,1,0,1,0,1,1,0,1,0,1,1,0,0,0,0,0,0,1,1,1,],
    [1,0,1,1,0,0,0,1,1,1,0,1,0,0,1,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,0,1,1,1,1,0,1,0,0,1,],
    [1,0,0,0,1,1,0,1,0,0,0,1,1,0,0,0,0,0,1,1,0,1,0,0,0,1,1,1,0,1,0,1,0,0,0,0,1,0,1,1,],
    [1,0,1,0,1,0,0,0,0,1,0,0,1,0,1,1,1,1,1,0,0,0,1,0,1,0,0,0,0,0,0,1,1,0,1,1,1,0,0,1,],
    [1,1,1,0,0,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,1,0,0,0,1,0,1,1,1,1,0,1,0,0,1,0,0,1,0,1,],
    [1,0,1,0,1,1,0,0,1,0,0,1,0,1,1,0,1,1,1,1,1,1,1,1,0,1,0,1,0,0,0,0,0,1,0,1,0,0,0,1,],
    [1,0,0,0,0,0,1,0,1,1,0,0,0,0,1,0,1,0,0,0,1,0,0,0,0,1,0,1,1,1,1,1,1,0,0,1,1,0,1,1,],
    [1,0,1,1,1,0,1,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,1,],
    [1,0,0,1,0,0,0,0,1,0,0,0,0,1,0,1,1,0,0,1,1,0,0,0,1,1,0,0,0,1,1,1,1,0,0,0,1,0,0,0,],
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,]
    ]

    maze1 = [
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,],
    [0,0,0,1,1,1,0,0,1,1,1,0,1,0,1,1,1,0,0,0,0,1,0,0,1,0,0,0,0,0,1,1,1,0,0,0,0,1,0,1,],
    [1,1,0,1,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,1,1,0,1,1,0,0,0,0,1,1,0,0,0,1,],
    [1,0,0,0,0,1,1,1,1,0,1,0,1,0,1,0,1,0,0,0,1,1,0,1,0,0,0,0,1,1,1,0,1,0,0,1,1,1,0,1,],
    [1,0,1,1,0,1,0,0,0,0,1,1,0,1,1,0,0,1,1,0,1,1,1,1,1,0,1,0,1,0,0,0,1,1,1,0,0,0,1,1,],
    [1,0,1,0,1,1,1,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,0,0,0,0,1,0,0,0,1,0,1,0,0,0,1,0,1,1,],
    [1,0,0,0,1,0,0,0,1,1,1,1,0,1,0,0,0,1,0,1,0,1,1,0,1,0,0,1,1,0,1,0,0,0,1,0,0,1,0,1,],
    [1,1,1,0,0,0,1,0,1,1,0,0,0,0,0,1,0,1,0,1,1,0,0,0,1,1,1,0,1,1,1,1,1,0,1,1,0,0,0,1,],
    [1,0,1,1,1,0,0,1,0,0,1,1,1,1,0,1,0,1,1,0,0,0,1,0,1,0,1,0,0,0,0,0,1,1,0,0,1,1,1,1,],
    [1,0,0,0,0,1,0,0,0,1,0,0,0,1,1,1,1,0,0,0,1,0,1,1,1,0,1,0,1,1,1,0,1,0,1,0,0,0,0,1,],
    [1,1,1,0,1,1,1,1,0,0,1,1,0,0,0,0,0,0,1,0,1,0,1,0,0,0,1,1,0,0,0,0,1,0,0,0,1,1,0,1,],
    [1,0,0,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,1,0,0,0,0,1,0,0,0,0,1,1,1,0,1,1,1,0,0,0,1,],
    [1,1,0,1,1,1,1,0,0,0,0,0,1,0,0,0,1,0,1,1,1,1,1,0,1,1,1,1,0,1,0,1,0,0,0,0,0,1,1,1,],
    [1,1,0,0,0,0,1,0,1,1,1,0,1,0,1,0,1,0,1,0,0,1,0,0,0,1,0,0,0,0,0,1,1,1,0,1,0,0,1,1,],
    [1,1,0,1,0,1,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,1,0,1,1,1,0,1,1,1,0,1,0,1,0,1,1,1,0,1,],
    [1,1,0,1,0,0,1,1,1,0,1,1,1,0,1,0,0,1,0,1,0,0,0,0,0,1,1,1,0,0,0,0,0,1,0,0,0,0,0,1,],
    [1,0,0,0,1,0,0,0,1,1,1,0,0,0,0,1,1,1,0,1,0,1,1,1,0,1,0,1,0,1,1,1,0,1,0,1,0,1,1,1,],
    [1,0,1,1,0,0,1,0,0,0,1,0,1,1,1,0,1,0,1,1,0,1,1,0,0,0,0,1,0,1,1,1,1,1,0,1,0,0,0,1,],
    [1,0,1,0,1,1,0,0,1,0,0,0,0,1,1,0,1,0,0,0,1,0,1,0,1,1,0,1,1,0,0,0,0,1,1,1,1,1,0,1,],
    [1,0,1,0,0,0,1,1,1,0,1,1,1,1,1,0,0,0,1,0,1,0,0,0,0,1,0,0,1,1,0,1,1,0,0,0,0,0,0,1,],
    [1,0,1,0,1,0,0,0,1,1,1,1,0,0,1,0,1,1,1,0,0,0,1,1,0,1,1,1,0,0,0,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,0,1,0,0,0,0,1,1,0,0,0,0,0,1,0,1,1,1,0,1,0,0,0,0,1,0,0,0,1,0,0,0,0,1,1,],
    [1,0,0,1,0,1,1,1,1,0,1,1,1,0,1,1,1,1,1,1,0,0,0,0,1,1,0,1,0,1,1,1,0,1,1,1,0,1,0,1,],
    [1,1,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,0,1,0,1,1,0,0,0,1,1,0,0,0,1,0,0,0,0,1,0,1,],
    [1,1,1,0,0,1,0,1,1,1,0,0,0,1,0,1,0,0,1,0,1,0,0,0,0,1,0,1,1,1,0,1,1,1,0,1,0,0,0,1,],
    [1,1,1,0,1,1,0,0,0,0,0,1,1,0,0,0,0,1,0,0,0,1,0,1,0,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,],
    [1,1,0,0,0,1,0,1,1,1,1,1,1,1,1,1,0,1,1,1,0,1,0,1,1,0,1,1,0,0,0,1,0,1,1,1,0,0,0,1,],
    [1,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,1,0,0,0,0,0,0,1,0,0,0,1,0,1,1,1,0,0,0,1,0,1,1,1,],
    [1,0,0,0,0,0,0,0,0,1,1,0,0,0,0,1,0,0,1,1,1,1,0,1,1,1,0,1,1,1,1,1,1,0,1,0,0,0,1,1,],
    [1,0,1,1,0,1,1,1,0,1,1,0,1,0,1,1,0,1,1,0,1,1,1,0,1,0,0,0,1,1,0,0,0,0,1,1,1,0,1,1,],
    [1,0,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,1,1,0,0,0,1,0,0,0,1,1,1,1,1,0,1,0,1,0,0,0,0,1,],
    [1,1,0,1,0,1,0,1,1,1,0,0,0,1,1,0,0,0,1,0,1,0,1,0,1,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,],
    [1,0,0,1,0,1,0,0,0,0,1,1,1,0,1,0,1,0,0,0,1,0,0,0,0,1,1,1,0,0,1,0,1,0,0,0,0,1,0,1,],
    [1,1,1,0,0,1,0,1,0,1,1,1,1,0,0,0,1,0,1,1,1,0,1,1,1,1,0,0,0,1,1,1,1,0,1,1,0,0,0,1,],
    [1,0,0,1,1,1,0,1,0,0,0,0,1,0,1,1,0,0,0,0,1,1,1,1,0,0,0,1,0,0,1,1,0,0,0,1,1,1,0,1,],
    [1,1,0,0,0,1,0,1,0,1,0,1,1,1,1,0,0,1,1,0,1,0,0,0,0,1,0,1,1,1,0,1,0,1,1,0,0,0,1,1,],
    [1,0,0,1,0,0,0,0,1,1,0,0,0,0,1,0,1,0,0,0,0,1,0,1,0,1,0,1,1,1,0,0,0,0,1,1,0,1,1,1,],
    [1,1,1,1,0,1,1,1,0,0,0,1,0,1,0,0,0,1,1,1,1,0,0,1,1,0,0,0,1,1,0,1,1,1,0,0,0,1,1,1,],
    [1,0,0,0,0,0,0,1,0,1,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,0,1,0,0,0,0,0,0,1,0,0,0,0,],
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,]   
    ]

    def getPath(maze,x1,y1,x2,y2):
        stack = []
        path = []
        shorts = []
        stack.append((x1,y1))
        while len(stack)>0:
            curNode = stack[-1]  #当前的节点
            if curNode[0] == x2 and curNode[1] == y2:
                X1 = x1
                Y1 = y1
                for p in stack:
                    if p[0] != X1:
                        if p[0] - 1 == X1:
                            path.append("down") #down 0
                        else:
                            path.append("up") #up d
                    if p[1] != Y1:
                        if p[1] - 1 == Y1:
                            path.append("right") #right 3
                        else:
                            path.append("left") #left g
                    X1 = p[0]
                    Y1 = p[1]
                print("xyPosition:\n",stack)
                print("stepPosition:\n",path)
                Tmp = ''
                for d in path:
                    if d!=Tmp:
                        shorts.append(d)
                        Tmp = d       
                print("step:\n",shorts)
                print("control:\n",'-'.join(shorts))
                return stack,path    #Ture
     
            for di in dirs:
                nextNode = di(curNode[0],curNode[1])  #如果下一个结点可以走
                if maze[nextNode[0]][nextNode[1]] ==0:
                    stack.append(nextNode)
                    maze[nextNode[0]][nextNode[1]] = 2  #标记为已经走过
                    break
            else:
                maze[nextNode[0]][nextNode[1]] = 2
                stack.pop()
        else:
            print("noWay")
            return False

    dirs = [
        lambda x, y: (x + 1, y),
        lambda x, y: (x - 1, y),
        lambda x, y: (x, y - 1),
        lambda x, y: (x, y + 1)
    ]

    #解出map0,map1的路线
    s0 = getPath(maze0,1,0,38,39)
    s1 = getPath(maze1,1,0,38,39)

    #找出map0与map1所有公共点，
    #可能地图丛这里开始变化，
    #拼接之前与之后的路线
    for i in s0[0]:
        for j in s1[0]:
            if i == j:
                print(i)
    #得出操作迷宫变换点为（25,19）           
    #将map0与map1断开，拼接路线
    path = []
    bz = False
    for i in s0[0]:
        if i == (25,19):
            break
        path.append(s0[1][s0[0].index(i)])
    for j in s1[0]: 
        if j == (25,19):
            bz = True
        if bz:
            path.append(s1[1][s1[0].index(j)-1])
            
    #去掉重复操作
    flag = []
    Tmp = ''
    for d in path:
        if d!=Tmp:
            flag.append(d)
            Tmp = d
    print("result control:\n",'-'.join(flag))
    ​```
    result control:
     right-down-right-up-right-down-right-down-right-down-right-down-right-down-left-down-left-down-right-down-right-down-right-down-right-up-right-down-right-down-left-down-left-down-left-down-left-down-right-down-right-up-right-down-right-down-right-down-left-down-left-down-left-up-left-down-left-down-left-down-left-down-right-down-right-up-right-up-right-up-right-up-right-up-right-up-right-up-right-up-left-up-right-up-right-down-right-down-left-down-right-down-left-down-left-down-left-down-left-down-right-up-right-down-right
    ​```

    image-20221119164616481

    得到新的操作路线，操作得到

    image-20221119170710223

    最后，按照poster的提示，更换“上下左右”为“d0g3”，生成md5的flag。

    image-20221119164856467

    完整代码为：

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    99
    100
    101
    102
    103
    104
    105
    106
    107
    108
    109
    110
    111
    112
    113
    114
    115
    116
    117
    118
    119
    120
    121
    122
    123
    124
    125
    126
    127
    128
    129
    130
    131
    132
    133
    134
    135
    136
    137
    138
    139
    140
    141
    142
    143
    144
    145
    146
    147
    148
    149
    150
    151
    152
    153
    154
    155
    156
    157
    158
    159
    160
    161
    162
    163
    164
    165
    166
    167
    168
    169
    170
    171
    172
    173
    174
    175
    176
    177
    178
    179
    180
    import hashlib

    #使用栈来存储路径
    maze0 = [
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,],
    [0,0,1,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,1,1,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,],
    [1,0,0,0,1,0,0,0,1,0,0,1,1,1,0,1,1,0,1,0,0,1,1,1,0,1,1,0,0,1,1,1,0,1,0,0,1,0,1,1,],
    [1,1,1,0,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,1,0,1,1,0,0,0,0,1,1,0,0,0,1,1,],
    [1,0,0,1,0,1,0,0,0,0,0,0,1,1,0,0,1,1,1,1,1,1,0,1,0,0,0,1,1,1,0,1,0,0,0,1,1,0,0,1,],
    [1,0,1,1,0,1,0,1,1,1,1,0,0,1,1,1,0,1,0,0,0,0,0,1,1,1,0,1,0,1,0,0,1,1,0,0,0,1,1,1,],
    [1,0,0,0,1,0,0,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,0,1,1,0,0,0,0,1,1,0,0,0,1,1,1,0,0,1,],
    [1,0,1,0,0,0,1,0,1,0,0,1,1,1,1,1,0,1,0,0,0,1,1,1,1,0,1,1,0,1,1,0,1,0,0,0,0,0,1,1,],
    [1,1,0,0,1,1,0,0,0,0,1,0,0,1,0,0,0,0,0,1,0,1,0,1,0,0,0,1,1,1,0,1,1,1,1,0,1,0,0,1,],
    [1,1,0,1,0,0,1,1,1,0,1,1,0,1,0,1,1,1,0,1,0,1,0,0,0,1,0,0,0,0,0,1,0,0,0,0,1,1,1,1,],
    [1,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,1,0,1,0,0,0,1,1,1,1,1,1,1,1,0,0,0,1,1,0,1,0,0,1,],
    [1,0,1,1,1,1,0,1,1,1,0,1,0,1,1,1,0,0,1,0,1,1,0,1,0,0,1,1,1,0,1,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,1,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,],
    [1,0,0,0,1,0,1,1,0,1,1,0,1,1,1,1,0,1,1,1,1,1,0,1,1,0,1,0,1,0,1,1,1,1,0,0,0,1,0,1,],
    [1,1,1,0,0,0,1,0,0,0,0,1,0,0,1,0,0,0,0,1,1,1,1,0,1,1,1,0,0,0,0,0,1,1,1,1,0,1,1,1,],
    [1,0,0,1,1,0,1,1,1,1,0,1,1,0,1,0,1,1,0,1,0,0,0,0,1,0,1,0,1,1,1,0,1,1,0,0,0,0,0,1,],
    [1,1,0,0,0,0,0,0,1,0,1,1,1,0,1,1,1,0,0,0,1,0,1,0,0,0,1,1,0,1,0,0,0,1,0,1,1,1,0,1,],
    [1,0,0,1,1,1,1,0,1,0,1,0,0,0,1,0,1,0,1,0,0,0,1,1,1,0,1,0,1,1,0,1,0,1,1,1,0,0,1,1,],
    [1,0,1,0,1,1,0,0,0,0,1,0,1,0,0,0,1,0,1,1,1,0,1,0,0,0,0,0,1,0,1,1,1,0,0,0,0,1,0,1,],
    [1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,1,0,0,0,1,0,1,0,0,1,1,1,0,1,0,0,0,0,0,1,1,0,1,0,1,],
    [1,1,1,0,1,0,0,0,0,1,1,0,1,0,1,1,0,1,1,1,0,1,0,1,0,0,0,1,0,0,1,0,1,1,1,0,1,0,0,1,],
    [1,0,1,1,0,0,1,1,0,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,0,0,1,1,1,0,0,0,0,0,1,0,1,1,],
    [1,0,0,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,0,1,0,1,1,1,0,1,1,1,0,1,1,1,1,0,1,0,0,0,1,1,],
    [1,1,0,0,0,1,0,1,1,0,1,0,0,1,1,0,1,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,1,1,1,1,1,],
    [1,1,0,1,0,1,0,0,0,0,0,0,1,0,0,0,1,0,1,0,1,0,0,1,1,1,1,1,0,1,0,1,1,0,1,0,0,0,0,1,],
    [1,1,0,1,0,0,0,1,1,1,1,0,1,0,1,0,1,0,0,0,0,1,0,0,0,1,1,0,0,0,0,1,0,1,1,1,1,1,0,1,],
    [1,0,0,1,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,1,1,1,1,1,1,0,1,0,1,1,0,1,0,0,0,0,0,1,0,1,],
    [1,0,1,0,0,0,0,0,1,0,1,1,1,0,1,1,0,0,0,0,1,0,0,0,0,0,1,1,1,1,1,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,1,1,1,0,1,0,0,0,1,0,0,1,1,1,0,1,0,1,1,1,0,1,0,0,0,1,1,0,1,0,0,0,0,0,1,],
    [1,0,0,1,0,0,0,0,0,1,1,0,1,1,1,0,0,0,0,0,0,0,1,0,0,0,0,1,0,1,0,0,1,1,1,1,0,1,0,1,],
    [1,1,0,0,0,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,1,0,1,0,1,1,0,1,0,1,1,0,0,0,0,0,0,1,1,1,],
    [1,0,1,1,0,0,0,1,1,1,0,1,0,0,1,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,0,1,1,1,1,0,1,0,0,1,],
    [1,0,0,0,1,1,0,1,0,0,0,1,1,0,0,0,0,0,1,1,0,1,0,0,0,1,1,1,0,1,0,1,0,0,0,0,1,0,1,1,],
    [1,0,1,0,1,0,0,0,0,1,0,0,1,0,1,1,1,1,1,0,0,0,1,0,1,0,0,0,0,0,0,1,1,0,1,1,1,0,0,1,],
    [1,1,1,0,0,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,1,0,0,0,1,0,1,1,1,1,0,1,0,0,1,0,0,1,0,1,],
    [1,0,1,0,1,1,0,0,1,0,0,1,0,1,1,0,1,1,1,1,1,1,1,1,0,1,0,1,0,0,0,0,0,1,0,1,0,0,0,1,],
    [1,0,0,0,0,0,1,0,1,1,0,0,0,0,1,0,1,0,0,0,1,0,0,0,0,1,0,1,1,1,1,1,1,0,0,1,1,0,1,1,],
    [1,0,1,1,1,0,1,0,1,1,0,1,1,1,0,0,0,0,1,0,0,0,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,1,],
    [1,0,0,1,0,0,0,0,1,0,0,0,0,1,0,1,1,0,0,1,1,0,0,0,1,1,0,0,0,1,1,1,1,0,0,0,1,0,0,0,],
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,]
    ]

    maze1 = [
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,],
    [0,0,0,1,1,1,0,0,1,1,1,0,1,0,1,1,1,0,0,0,0,1,0,0,1,0,0,0,0,0,1,1,1,0,0,0,0,1,0,1,],
    [1,1,0,1,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,1,1,0,1,1,0,0,0,0,1,1,0,0,0,1,],
    [1,0,0,0,0,1,1,1,1,0,1,0,1,0,1,0,1,0,0,0,1,1,0,1,0,0,0,0,1,1,1,0,1,0,0,1,1,1,0,1,],
    [1,0,1,1,0,1,0,0,0,0,1,1,0,1,1,0,0,1,1,0,1,1,1,1,1,0,1,0,1,0,0,0,1,1,1,0,0,0,1,1,],
    [1,0,1,0,1,1,1,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,0,0,0,0,1,0,0,0,1,0,1,0,0,0,1,0,1,1,],
    [1,0,0,0,1,0,0,0,1,1,1,1,0,1,0,0,0,1,0,1,0,1,1,0,1,0,0,1,1,0,1,0,0,0,1,0,0,1,0,1,],
    [1,1,1,0,0,0,1,0,1,1,0,0,0,0,0,1,0,1,0,1,1,0,0,0,1,1,1,0,1,1,1,1,1,0,1,1,0,0,0,1,],
    [1,0,1,1,1,0,0,1,0,0,1,1,1,1,0,1,0,1,1,0,0,0,1,0,1,0,1,0,0,0,0,0,1,1,0,0,1,1,1,1,],
    [1,0,0,0,0,1,0,0,0,1,0,0,0,1,1,1,1,0,0,0,1,0,1,1,1,0,1,0,1,1,1,0,1,0,1,0,0,0,0,1,],
    [1,1,1,0,1,1,1,1,0,0,1,1,0,0,0,0,0,0,1,0,1,0,1,0,0,0,1,1,0,0,0,0,1,0,0,0,1,1,0,1,],
    [1,0,0,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,1,0,0,0,0,1,0,0,0,0,1,1,1,0,1,1,1,0,0,0,1,],
    [1,1,0,1,1,1,1,0,0,0,0,0,1,0,0,0,1,0,1,1,1,1,1,0,1,1,1,1,0,1,0,1,0,0,0,0,0,1,1,1,],
    [1,1,0,0,0,0,1,0,1,1,1,0,1,0,1,0,1,0,1,0,0,1,0,0,0,1,0,0,0,0,0,1,1,1,0,1,0,0,1,1,],
    [1,1,0,1,0,1,0,0,1,0,0,0,0,0,1,1,0,0,0,1,0,1,0,1,1,1,0,1,1,1,0,1,0,1,0,1,1,1,0,1,],
    [1,1,0,1,0,0,1,1,1,0,1,1,1,0,1,0,0,1,0,1,0,0,0,0,0,1,1,1,0,0,0,0,0,1,0,0,0,0,0,1,],
    [1,0,0,0,1,0,0,0,1,1,1,0,0,0,0,1,1,1,0,1,0,1,1,1,0,1,0,1,0,1,1,1,0,1,0,1,0,1,1,1,],
    [1,0,1,1,0,0,1,0,0,0,1,0,1,1,1,0,1,0,1,1,0,1,1,0,0,0,0,1,0,1,1,1,1,1,0,1,0,0,0,1,],
    [1,0,1,0,1,1,0,0,1,0,0,0,0,1,1,0,1,0,0,0,1,0,1,0,1,1,0,1,1,0,0,0,0,1,1,1,1,1,0,1,],
    [1,0,1,0,0,0,1,1,1,0,1,1,1,1,1,0,0,0,1,0,1,0,0,0,0,1,0,0,1,1,0,1,1,0,0,0,0,0,0,1,],
    [1,0,1,0,1,0,0,0,1,1,1,1,0,0,1,0,1,1,1,0,0,0,1,1,0,1,1,1,0,0,0,1,0,1,0,1,1,1,0,1,],
    [1,0,1,0,1,0,1,0,0,0,0,1,1,0,0,0,0,0,1,0,1,1,1,0,1,0,0,0,0,1,0,0,0,1,0,0,0,0,1,1,],
    [1,0,0,1,0,1,1,1,1,0,1,1,1,0,1,1,1,1,1,1,0,0,0,0,1,1,0,1,0,1,1,1,0,1,1,1,0,1,0,1,],
    [1,1,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,0,1,0,1,1,0,0,0,1,1,0,0,0,1,0,0,0,0,1,0,1,],
    [1,1,1,0,0,1,0,1,1,1,0,0,0,1,0,1,0,0,1,0,1,0,0,0,0,1,0,1,1,1,0,1,1,1,0,1,0,0,0,1,],
    [1,1,1,0,1,1,0,0,0,0,0,1,1,0,0,0,0,1,0,0,0,1,0,1,0,0,1,1,0,1,0,0,0,0,0,1,1,1,0,1,],
    [1,1,0,0,0,1,0,1,1,1,1,1,1,1,1,1,0,1,1,1,0,1,0,1,1,0,1,1,0,0,0,1,0,1,1,1,0,0,0,1,],
    [1,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,1,0,0,0,0,0,0,1,0,0,0,1,0,1,1,1,0,0,0,1,0,1,1,1,],
    [1,0,0,0,0,0,0,0,0,1,1,0,0,0,0,1,0,0,1,1,1,1,0,1,1,1,0,1,1,1,1,1,1,0,1,0,0,0,1,1,],
    [1,0,1,1,0,1,1,1,0,1,1,0,1,0,1,1,0,1,1,0,1,1,1,0,1,0,0,0,1,1,0,0,0,0,1,1,1,0,1,1,],
    [1,0,0,1,0,0,0,0,1,1,1,0,1,0,0,0,1,1,1,0,0,0,1,0,0,0,1,1,1,1,1,0,1,0,1,0,0,0,0,1,],
    [1,1,0,1,0,1,0,1,1,1,0,0,0,1,1,0,0,0,1,0,1,0,1,0,1,1,1,1,1,0,0,0,1,1,1,0,1,1,1,1,],
    [1,0,0,1,0,1,0,0,0,0,1,1,1,0,1,0,1,0,0,0,1,0,0,0,0,1,1,1,0,0,1,0,1,0,0,0,0,1,0,1,],
    [1,1,1,0,0,1,0,1,0,1,1,1,1,0,0,0,1,0,1,1,1,0,1,1,1,1,0,0,0,1,1,1,1,0,1,1,0,0,0,1,],
    [1,0,0,1,1,1,0,1,0,0,0,0,1,0,1,1,0,0,0,0,1,1,1,1,0,0,0,1,0,0,1,1,0,0,0,1,1,1,0,1,],
    [1,1,0,0,0,1,0,1,0,1,0,1,1,1,1,0,0,1,1,0,1,0,0,0,0,1,0,1,1,1,0,1,0,1,1,0,0,0,1,1,],
    [1,0,0,1,0,0,0,0,1,1,0,0,0,0,1,0,1,0,0,0,0,1,0,1,0,1,0,1,1,1,0,0,0,0,1,1,0,1,1,1,],
    [1,1,1,1,0,1,1,1,0,0,0,1,0,1,0,0,0,1,1,1,1,0,0,1,1,0,0,0,1,1,0,1,1,1,0,0,0,1,1,1,],
    [1,0,0,0,0,0,0,1,0,1,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,1,0,1,0,0,0,0,0,0,1,0,0,0,0,],
    [1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,]   
    ]

    dirs = [
        lambda x, y: (x + 1, y),
        lambda x, y: (x - 1, y),
        lambda x, y: (x, y - 1),
        lambda x, y: (x, y + 1)
    ]
     
    def getPath(maze,x1,y1,x2,y2):
        stack = []
        path = []
        shorts = []
        stack.append((x1,y1))
        while len(stack)>0:
            curNode = stack[-1]  #当前的节点
            if curNode[0] == x2 and curNode[1] == y2:
                X1 = x1
                Y1 = y1
                for p in stack:
                    if p[0] != X1:
                        if p[0] - 1 == X1:
                            path.append("0") #down 0
                        else:
                            path.append("d") #up d
                    if p[1] != Y1:
                        if p[1] - 1 == Y1:
                            path.append("3") #right 3
                        else:
                            path.append("g") #left g
                    X1 = p[0]
                    Y1 = p[1]
                print("xyPosition:\n",stack)
                print("stepPosition:\n",path)
                Tmp = ''
                for d in path:
                    if d!=Tmp:
                        shorts.append(d)
                        Tmp = d       
                print("step:\n",shorts)
                print("control:\n",''.join(shorts))
                return stack,path    #Ture
     
            for di in dirs:
                nextNode = di(curNode[0],curNode[1])  #如果下一个结点可以走
                if maze[nextNode[0]][nextNode[1]] ==0:
                    stack.append(nextNode)
                    maze[nextNode[0]][nextNode[1]] = 2  #标记为已经走过
                    break
            else:
                maze[nextNode[0]][nextNode[1]] = 2
                stack.pop()
        else:
            print("noWay")
            return False
    #解出map0,map1的路线
    s0 = getPath(maze0,1,0,38,39)
    s1 = getPath(maze1,1,0,38,39)

    #找出map0与map1所有公共点，
    #可能地图丛这里开始变化，
    #拼接之前与之后的路线
    for i in s0[0]:
        for j in s1[0]:
            if i == j:
                print(i)
                
    #将map0与map1断开，拼接路线
    path = []
    bz = False
    for i in s0[0]:
        if i == (25,19):
            break
        path.append(s0[1][s0[0].index(i)])
    for j in s1[0]: 
        if j == (25,19):
            bz = True
        if bz:
            path.append(s1[1][s1[0].index(j)-1])
            
    #去掉重复操作
    flag = []
    Tmp = ''
    for d in path:
        if d!=Tmp:
            flag.append(d)
            Tmp = d
            
    #md5加密得到flag
    md5 = hashlib.md5()
    md5.update(''.join(flag).encode(encoding='utf-8'))
    print("result control:\n",'-'.join(flag))
    print("flag:\n","D0g3{%s}"%md5.hexdigest())

    image-20221119165158283

    flag为:

    1
    D0g3{8c4c8e4247928992fb37474512c52569}
    上一篇:
    写一个Android第一代壳
    下一篇:
    Win32笔记-高级
    本文目录
    本文目录
    Copyright © 2019 - 2021 kuangtant | Powered by Hexo | Theme Bamboo
    本站总阅读量： 次 本站总访问量： 次 |